Security at OpenWAF
How we protect the service and your clients’ sites, and how to report a vulnerability to us.
Built to fail safe
The facts about how OpenWAF is put together today.
EU data location
Edge nodes and DNS servers run on Hetzner in Germany. Customer data is stored in the EU (Germany).
Signed configuration
Configuration documents are signed with Ed25519; edge nodes reject anything that doesn’t verify.
Last-known-good
Nodes keep serving with the last valid configuration if the control plane is unreachable.
Hidden DNS primary
The primary DNS server isn’t exposed to the Internet; only the public secondaries answer queries.
Change control
Every change is versioned, needs a reason and is written to the audit log. Rollback is one step.
API tokens
Tokens are stored only as hashes, have a role and an expiry date, and can be revoked.
TLS everywhere
Visitors reach the edge over TLS with managed certificates, and nodes fetch their configuration over TLS.
A quiet website
This website sets no cookies, loads nothing from third parties and is served with a strict Content Security Policy.
Report a vulnerability
If you think you have found a security vulnerability in OpenWAF, please tell us. We read every report.
How to report
E-mail [email protected] in English or Spanish. Our security.txt lists the same contact. Please include:
- a description of the issue and its impact;
- the steps to reproduce it, with the affected hostnames or URLs;
- how we can contact you, and whether you would like to be credited.
Guidelines
- Act in good faith
Only test accounts and sites you own or are authorised to test.
- Leave other people’s data alone
Don’t access, change or delete data that isn’t yours. If you come across some, stop and tell us.
- Don’t degrade the service
No denial-of-service, volumetric tests or heavy automated scanning, and no social engineering or physical attacks.
- Give us time
Allow us a reasonable time to fix the issue before you disclose it publicly.
- Our side
We will reply, keep you informed and, if you wish, credit you once it is fixed. We won’t take legal action over research done in good faith under these guidelines. We don’t run a paid bug bounty.
In scope
openwaf.devand the subdomains we operate- Our nameservers,
*.ns.openwaf.dev - Our edge nodes and the protection they apply
- The API and the
openwaf-cloud ctlCLI
Out of scope
- Our customers’ websites and origin servers: please contact the site owner
- Third-party services: report to their owners
- Reports without a security impact, such as best-practice suggestions with no exploit
To report a website behind OpenWAF that hosts phishing, malware or other abuse, write to [email protected] instead.